日志记录无法在Spring安全数据库中与加密密码集成

时间：2012-05-15 06:20:21

标签： spring spring-security spring-3

我已经创建了一个应用程序，其中我使用了Spring安全数据库驱动和密码加密。但它不起作用。如果我将用户凭证配置为xml文件作为加密密码，它可以正常工作。如果有人知道解决方案，请帮忙。

我使用org.springframework.security.authentication.encoding.ShaPasswordEncoder.encodePassword（“password”，null）编码了密码; 如果有人知道解决方案，请重播。谢谢。

这是我的applicationContext.xml 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
       http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<!-- ADD PERSISTENCE SUPPORT HERE (jpa, hibernate, etc) -->
<bean class="org.apache.commons.dbcp.BasicDataSource" id="dataSource" destroy-method="close" >
        <property name="driverClassName">
            <value>com.microsoft.sqlserver.jdbc.SQLServerDriver</value>
        </property>
        <property name="url">
            <value>jdbc:sqlserver://192.162.101.111;databaseName=test</value>
        </property>
        <property name="username">
            <value>root</value>
        </property>
        <property name="password">
            <value>testroot</value>
        </property>
        <property name="maxActive" value="100"/>
        <property name="maxWait" value="10000"/>
    <property name="maxIdle" value="10"/>
    </bean>


<!--- Spring security configuration --->
<security:http auto-config="true"  >
<!-- Restrict URLs based on role -->
<security:intercept-url pattern="/POC/" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<security:intercept-url pattern="/common/reportgenerator/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />

<security:intercept-url pattern="/common/**" access="ROLE_BIDDER,ROLE_OFFICER" />

<security:intercept-url pattern="/bidder/**" access="ROLE_BIDDER" />
<security:intercept-url pattern="/officer/**" access="ROLE_OFFICER" />


<!--  Override default login and logout pages -->
<security:form-login login-page="/Login"
login-processing-url="/j_spring_security_check"
default-target-url="/"
always-use-default-target="true"
authentication-failure-url="/loginfailed" />
<security:logout logout-success-url="/logout" />
</security:http>


<security:authentication-manager>
       <security:authentication-provider user-service-ref=""  >
       <security:user-service >
        <security:user   name="krupa@egp.com"                           password="c06d3569e5cb23eea69c8e264cbb43d817b95c2d"                     authorities="ROLE_OFFICER" />
    </security:user-service>
    <security:jdbc-user-service data-source-ref="dataSource"
    users-by-username-query="select  emailid username,lower(password)   password,'true' enabled from tbl_LoginDetails where emailid=?"
    authorities-by-username-query="select a.emailid username,b.authority from   tbl_LoginDetails a,tbl_UserRoles b where a.userId=b.userId and a.emailid=?"     />
       <security:password-encoder ref="passwordEncoder" base64="false"/>
    </security:authentication-provider>
</security:authentication-manager>

<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"></bean>
</beans>

WEB.xml包含：

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <filter>
        <filter-name>encodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <filter-mapping>
        <filter-name>encodingFilter</filter-name>
        <url-pattern>/</url-pattern>
    </filter-mapping>

    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>

    <listener>
            <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
        </listener>
<listener>
        <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<listener>
    <listener-class>
        org.springframework.web.util.Log4jConfigListener
   </listener-class>
</listener>


 <!-- Spring Security filter entry -->
 <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
    </filter-mapping>
</web-app>

控制器详细信息：

package com.abc.controller;
import org.apache.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;

@Controller
@RequestMapping("/")
public class HomeController  
{
    private static Logger logger = Logger.getLogger("controller");
    @RequestMapping
    public String showHome(ModelMap model) {
        logger.debug("this is a sample log message.");

    if(SecurityContextHolder.getContext().getAuthentication().isAuthenticated() && !SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString().equalsIgnoreCase("anonymousUser"))
    {
    User user = null;
    user=(User)SecurityContextHolder.getContext().getAuthentication().getPrincipal();

    System.out.println(SecurityContextHolder.getContext().getAuthentication().getCredentials());

    if(user !=null )
    {
    String name = user.getUsername();
    model.addAttribute("username", name);
    }

 }
return "home";
}

    @RequestMapping(value="/loginfailed", method = RequestMethod.GET)
    public String loginerror(ModelMap model) {
        logger.debug("login failed");
        model.addAttribute("error", "true");
        return "login";

    }

    @RequestMapping(value="/logout")
    public String logout(ModelMap model) {
        logger.debug("log out");
        return "login";
    }

    @RequestMapping(value="/bidder/dashboard")
    public String bidderDashboard(ModelMap model) {
        return "bidder/dashboard";
    }

    @RequestMapping(value="/officer/dashboard")
    public String officerDashboard(ModelMap model) {
        return "officer/dashboard";
    }

}

我的登录Jsp页面如下：

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
<html>
<head>
<title>Login Page</title>
<style>
.errorblock {
    color: #ff0000;
    background-color: #ffEEEE;
    border: 3px solid #ff0000;
    padding: 8px;
    margin: 16px;
}
</style>
</head>
<body onload='document.f.j_username.focus();'>
    <h3>Login </h3>

    <c:if test="${not empty error}">
        <div class="errorblock">
            Your login attempt was not successful, try again.<br />                 Caused :<spring:message code="SPRING_SECURITY_LAST_EXCEPTION"           text="Default Text" />
        </div>
    </c:if>

    <form name='f' action="<c:url value='j_spring_security_check' />"
        method='POST'>
        <table>
            <tr>
                <td>User:</td>
                <td><input type='text' name='j_username' value=''>
                </td>
            </tr>
            <tr>
                <td>Password:</td>
                <td><input type='password' name='j_password' />
                </td>
            </tr>
            <tr>
                <td colspan='2'><input name="submit" type="submit"
                    value="submit" />
                </td>
            </tr>
            <tr>
                <td colspan='2'><input name="reset" type="reset" />
                </td>
            </tr>
        </table>
    </form>
</body>
</html>

2 个答案:

答案 0 :(得分：1)

这真的是你运行的配置文件吗？看起来它有一些问题，它

您为<authentication-manager>发布的语法不正确。您应该有多个authentication-provider元素，以便配置多个用户数据源进行身份验证。您只有一个，jdbc-user-service可能会被忽略，而有利于user-service元素。

没有与password-encoder元素关联的user-service，因此它不能与编码密码一起使用，尽管您可以这样做。你确定吗？

确保从密码的SQL查询中检索到的值与密码编码器为正确密码计算的值完全匹配（手动检查）。

如果这些都没有帮助，请更清楚地解释实际出现的问题。什么不起作用，你使用的是什么版本号？最重要的是，登录期间调试日志的输出是什么？这很可能会提供一些指示。

此外，web.xml，控制器和登录页面不太可能与密码编码问题相关（如果您可以使用一个配置而不是另一个配置成功登录），那么您可以删除它们。

答案 1 :(得分：0)

我相信有两件事不见了！
1.你不能有两个不同的元素。因此，要么删除其中一个，要么添加另一个身份验证提供程

2.我无法看到用户提供的密码加密的位置。你知道，两个密码（数据库中的密码和用户提供的密码）应该加密并且是相同的。

相关问题
最新问题